What Is BACnet? The Building Automation Protocol Explained
BACnet is the open data communication protocol for building automation and control networks, standardised as ISO 16484-5 and ANSI/ASHRAE 135.
If two pieces of building equipment from different manufacturers need to share data, BACnet is usually how they do it. This guide explains what BACnet is, how it models devices, the difference between BACnet/IP and BACnet MS/TP, how BACnet networks are built and routed, and how to troubleshoot the problems engineers meet most often.
What does BACnet stand for?
BACnet stands for Building Automation and Control networks. It was developed by ASHRAE (the American Society of Heating, Refrigerating and Air-Conditioning Engineers) from 1987, first published as ANSI/ASHRAE Standard 135 in 1995, and adopted as the international standard ISO 16484-5 in 2003. It is maintained by an ASHRAE committee and revised regularly.
BACnet was designed specifically for buildings, so it understands concepts such as schedules, calendars, alarms, trend logs and priorities natively. That makes it different from general industrial protocols such as Modbus, which only move raw numbers (see BACnet vs Modbus).
Why BACnet matters
Before BACnet, every BMS manufacturer used its own protocol. A building owner who chose one manufacturer was locked into it for every controller, sensor and service visit for the life of the building. BACnet broke that lock-in. Today:
- most HVAC controllers, chillers, boilers, heat pumps, VAV boxes and AHU controllers offer BACnet
- most supervisory platforms, including Tridium Niagara 4, include a BACnet driver as standard
- public-sector and corporate specifications routinely require BACnet at the field and automation levels
BACnet is not the only open protocol in buildings, but it is the one designed for the job.
How BACnet works: objects, properties and services
BACnet describes every device as a collection of objects. Each object has properties. Devices exchange data using services.
Objects
An object represents a piece of information or function in a device. Standard object types include:
| Object type | Abbreviation | Typical use |
|---|---|---|
| Analog Input | AI | Temperature, pressure, humidity readings |
| Analog Output | AO | Valve or damper position command |
| Analog Value | AV | Setpoints, calculated values |
| Binary Input | BI | Fan status, alarm contact |
| Binary Output | BO | Pump or fan start/stop |
| Binary Value | BV | Enable flags, occupancy mode |
| Multi-state Input/Output/Value | MSI/MSO/MSV | Modes such as off/low/medium/high |
| Schedule | SCHED | Weekly time schedules |
| Calendar | CAL | Holiday dates |
| Trend Log | TL | Logged history |
| Notification Class | NC | Alarm routing |
| Device | DEV | The device itself: name, vendor, instance number |
Every device has exactly one Device object, and every object is identified by its type and an instance number, for example Analog Input 3.
Properties
Each object has properties. The most important is Present_Value, the current value. Others include Object_Name, Description, Units, Status_Flags, Out_Of_Service and, for outputs and values, the Priority_Array.
The priority array is one of BACnet's most useful features. A commandable object has 16 priority levels. Several sources can write to the same output at different priorities (for example, life safety at priority 1, manual operator override at 8, and normal scheduling at 16), and the highest-priority active command wins. When a higher priority is released, control falls back automatically to the next one. Understanding this avoids a classic commissioning problem: "I wrote the value and it didn't change" usually means something else holds a higher priority.
Services
Services are the messages devices send each other. The ones you will meet constantly:
- Who-Is / I-Am: device discovery. A supervisor broadcasts Who-Is; devices reply I-Am with their instance number.
- Who-Has / I-Have: find which device holds a named object.
- ReadProperty / ReadPropertyMultiple: read values.
- WriteProperty: write a value, optionally at a priority.
- SubscribeCOV: ask a device to send updates only when a value changes (change of value), which is far more efficient than polling.
- Event and alarm notifications: devices report alarms to recipients defined in notification classes.
BACnet device instance numbers
Every BACnet device on an internetwork must have a unique device instance number between 0 and 4,194,302. Duplicate instances are one of the most common causes of devices "disappearing" or values coming from the wrong place. Plan instance numbers on the project, for example by encoding building, floor and controller, and record them in the network schedule.
BACnet network types: BACnet/IP vs BACnet MS/TP
BACnet runs over several data link layers. Two dominate modern buildings.
BACnet/IP
BACnet/IP carries BACnet messages over standard Ethernet and IP networks using UDP, normally on port 47808 (0xBAC0). It is fast, uses ordinary network infrastructure and suits controllers, AHU and chiller controllers, supervisors and anything else with an Ethernet port.
BACnet MS/TP
BACnet MS/TP (Master-Slave/Token-Passing) runs over RS-485 twisted-pair cable. It is cheap, robust and the standard way to connect large numbers of small field devices such as VAV controllers, fan coil controllers, room units and I/O modules.
Key characteristics of MS/TP:
- devices are daisy-chained on a single two-wire (plus reference) bus
- masters pass a token; only the token holder may transmit
- each device has a MAC address from 0 to 127 for masters (128–254 for slaves); every address on a trunk must be unique
- common baud rates are 9,600, 19,200, 38,400 and 76,800 bit/s; every device on the trunk must use the same rate
- practical limits are around 1,200 m of cable and 32 unit loads per segment without repeaters, though many modern transceivers present a fraction of a unit load and allow more devices
- the bus must be terminated and biased correctly (see RS-485 wiring, termination and biasing)
Comparison
| BACnet/IP | BACnet MS/TP | |
|---|---|---|
| Medium | Ethernet / IP | RS-485 twisted pair |
| Speed | 100 Mbit/s and above | 9.6 to 76.8 kbit/s |
| Addressing | IP address + UDP port | MAC address 0–127 on the trunk |
| Typical devices | Supervisors, plant controllers, chillers | VAV, FCU, room controllers, I/O modules |
| Cable cost | Network infrastructure | Cheap twisted pair |
| Distance | Unlimited via IP network | ~1,200 m per segment |
| Discovery | Broadcast within subnet; BBMD across subnets | Broadcast on the trunk |
Most real systems use both: BACnet/IP at the automation level and MS/TP trunks from routers or controllers down to the field devices.
Other BACnet data links
You may also meet BACnet Ethernet (raw Ethernet, now rare), BACnet/SC (Secure Connect, see below), and BACnet over LonTalk or PTP on older sites.
BACnet routers and networks
A BACnet network is one data link segment: an IP subnet or an MS/TP trunk. Each network has a unique network number (1–65,534). A BACnet router connects networks and forwards messages between them.
For example, a router such as the Netmaster BACnet MS/TP to BACnet/IP router connects an MS/TP trunk of VAV controllers (network 2001) to the building's BACnet/IP network (network 1). A JACE or IONA with RS-485 ports can play the same role, hosting MS/TP trunks directly and exposing them to the IP side through Niagara.
Rules that prevent most routing problems:
- every network number must be unique across the whole internetwork
- there must be only one path between any two networks; a second path creates a router loop, which floods the network with duplicated broadcasts
- routers on the same network must agree on its number
BBMDs: BACnet across IP subnets
BACnet/IP discovery (Who-Is) uses broadcasts, and IP routers do not forward broadcasts between subnets. A BBMD (BACnet Broadcast Management Device) solves this. One BBMD on each subnet forwards BACnet broadcasts to its peers listed in a Broadcast Distribution Table (BDT).
Common BBMD rules:
- only one BBMD per subnet
- every BBMD's BDT must list all the other BBMDs
- devices that cannot have a BBMD on their subnet (a laptop on VPN, for example) can register as foreign devices with a BBMD
Niagara can act as a BBMD, which is often the simplest solution on sites where the supervisor and controllers are on different subnets.
BACnet Secure Connect (BACnet/SC)
Traditional BACnet has no encryption or authentication. BACnet/SC (Secure Connect) adds TLS-encrypted, certificate-authenticated WebSocket connections through a hub, so BACnet traffic can cross IT networks safely and without broadcasts. Adoption is growing, and it is worth asking for on new projects where BACnet traffic will share infrastructure with corporate IT.
BACnet PICS, BIBBs and BTL certification
Not every BACnet device supports every BACnet feature. Three things tell you what a device can actually do:
- PICS (Protocol Implementation Conformance Statement): a manufacturer's document listing the object types, services and data links a device supports. Ask for it before buying. It tells you, for example, whether a controller supports COV, schedules, alarms or writing at priorities.
- BIBBs (BACnet Interoperability Building Blocks): standard groupings of services, such as DS-RP-B (data sharing, read property, server side). PICS documents list the BIBBs a device supports.
- Device profiles: standard device categories such as B-ASC (application-specific controller), B-AAC (advanced application controller), B-BC (building controller) and B-OWS (operator workstation). They give a quick idea of capability.
BTL (BACnet Testing Laboratories) certification means the device has been independently tested against the standard. A BTL-listed device is far less likely to cause interoperability problems, and many specifications require it.
BACnet in Niagara 4
Niagara 4 includes a full BACnet driver. The workflow is:
- Add a BacnetNetwork to the station and configure the Local Device (instance number, name).
- Enable the IP port (and MS/TP ports on a JACE or IONA's RS-485 interfaces).
- Discover devices (Who-Is) and add them.
- Discover each device's objects and add the ones you need as proxy points.
- Use COV subscriptions where devices support them, and polling elsewhere, tuned with the driver's poll scheduler and tuning policies.
- Optionally export Niagara points as BACnet objects so other BACnet systems can read them.
Watch LAB 11 of the Niagara 4 TCP video series for a walkthrough.
BACnet troubleshooting checklist
Device not discovered. Check it is powered and on the right network. On IP: same subnet or BBMD in place, UDP 47808 open, no duplicate device instance. On MS/TP: matching baud rate, unique MAC address, Max Master set high enough to include the device's address, correct polarity, termination and biasing.
Device found but drops in and out. Usually duplicate device instances, MS/TP addressing gaps causing token-passing delays, a router loop, or electrical noise on the trunk.
Values update slowly. MS/TP trunk overloaded. Reduce poll rates, use COV, raise the baud rate if every device supports it, or split the trunk.
Write has no effect. Something holds a higher priority in the priority array. Read the array to see which priority is active and release it.
Lots of broadcast traffic. A router loop or mis-configured BBMD tables. Map the network paths.
A protocol analyser such as Wireshark (for BACnet/IP) and an MS/TP capture tool are invaluable on difficult sites.
BACnet products
Tyrrell Products supplies BACnet controllers, routers, gateways and I/O modules for UK projects, including BACnet application controllers, BACnet I/O modules, Modbus to BACnet gateways in the integration gateway range, and Niagara controllers with full BACnet support.
Frequently asked questions
What is BACnet used for?
BACnet is used to let building automation devices from different manufacturers share data and commands: HVAC controllers, chillers, boilers, VAV boxes, lighting, metering and supervisory systems.
What is the difference between BACnet/IP and BACnet MS/TP?
BACnet/IP runs over Ethernet and IP networks at high speed. BACnet MS/TP runs over RS-485 twisted pair at up to 76.8 kbit/s and is used for low-cost field devices. Most buildings use both, linked by BACnet routers.
What port does BACnet use?
BACnet/IP normally uses UDP port 47808 (0xBAC0). Additional BACnet/IP networks on the same host sometimes use 47809 and upwards.
What is a BBMD in BACnet?
A BBMD (BACnet Broadcast Management Device) forwards BACnet/IP broadcasts between IP subnets so devices on different subnets can discover each other.
How many devices can be on a BACnet MS/TP network?
Up to 128 master addresses (0–127) per trunk, but the practical limit is set by unit loads, cable length and traffic. Around 32 devices per segment is a common design figure without repeaters.
Is BACnet better than Modbus?
For building automation, BACnet is generally richer because it models schedules, alarms, trends and priorities. Modbus is simpler and very common on meters and plant equipment. See BACnet vs Modbus for a full comparison.